Facebook pays teens to install VPN that spies on them

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Facebook pays teens to install VPN that spies on them (TechCrunch)

Desperate for data on its competitors, Facebook has been secretly paying people to install a “Facebook Research” VPN that lets the company suck in all of a user’s phone and web activity, similar to Facebook’s Onavo Protect app that Apple banned in June and that was removed i…

Since 2016, Facebook has been paying users ages 13 to 35 up to $20 per month plus referral fees to sell their privacy by installing the iOS or Android “Facebook Research” app. Facebook even asked users to screenshot their Amazon order history page. The program is administered through beta testing services Applause, BetaBound and uTest to cloak Facebook’s involvement, and is referred to in some documentation as “Project Atlas” — a fitting name for Facebook’s effort to map new trends and rivals around the globe.

I figured we’d been almost a day since Facebook were last in the news for privacy and ethics-related concerns (earlier this week, earlier still), so we must’ve been due more coverage. This time, it’s about Facebook’s latest tack in trying to understand the teen market that it’s failing to penetrate as well as it once did, and the fact that it’s been paying young adults and children to proxy all of their traffic through Facebook’s servers including setting up their phones to allow Facebook to break their encryption so that it can understand how they’re using them.

The Search for England’s Forgotten Footpaths

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Nineteen years ago, the British government passed one of its periodic laws to manage how people move through the countryside. The Countryside and Rights of Way Act created a new “right to roam” on common land, opening up three million acres of mountains and moor, heath and down, to cyclists, climbers, and dog walkers. It also set an ambitious goal: to record every public path crisscrossing England and Wales by January 1, 2026. The British Isles have been walked for a long time. They have been mapped, and mapped again, for centuries. But that does not mean that everything adds up, or makes sense. Between them, England and Wales have around a hundred and forty thousand miles of footpaths, of which around ten per cent are impassable at any time, with another ten thousand miles that are thought to have dropped off maps or otherwise misplaced. Finding them all again is like reconstructing the roots of a tree. In 2004, a government project, named Discovering Lost Ways, was given a fifteen-million-pound budget to solve the problem. It ended four years later, overwhelmed. “Lost Footpaths to Stay Lost,” the Daily Telegraph reported. Since then, despite the apparent impossibility of the task, the 2026 cutoff has remained on the statute books, leaving the job of finding and logging the nation’s forgotten paths to walkers, horse people, and other obsessives who can’t abide the muddled situation.

A couple of days into the New Year, with the deadline now only seven years off, I met Bob Fraser, a retired highway engineer, in a parking lot a few miles outside Truro, in Cornwall, in the far west of England. Fraser grew up in Cornwall and returned about thirty years ago, which is when he noticed that many footpaths were inaccessible or ended for no reason. “I suppose that got me interested in trying to get the problem sorted out,” he said. Since he retired, seven years ago, Fraser has been researching and walking more or less full time; in the past three years, he has applied to reinstate sixteen lost paths.

The 500-Year-Long Science Experiment

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

The 500-Year-Long Science Experiment (The Atlantic)

In 2014, microbiologists began a study that they hope will continue long after they’re dead.

In the year 2514, some future scientist will arrive at the University of Edinburgh (assuming the university still exists), open a wooden box (assuming the box has not been lost), and break apart a set of glass vials in order to grow the 500-year-old dried bacteria inside. This all assumes the entire experiment has not been forgotten, the instructions have not been garbled, and science—or some version of it—still exists in 2514.

This is a biology experiment that’s planned to run for half a millenium. How does one even make such a thing possible?

Thinking about the difficulties in constructing a message that may be understood for generations into the future reminds me of the work done on a possible marking system for nuclear waste disposal (which would need to continue to carry the message that a place is dangerous for ten thousand years).

This kind of philosophical thinking may require further work, though, if we’re ever to send spacecraft on interstellar journeys: another kind of “long” experiment. How might we preserve the records of what we’ve done, so that our descendants have the opportunity to continue our work, in a way that promotes the iterative translation and preservation of the messages that are required to support it? For example: if an experiment is to be understandable if rediscovered after a hypothetical future dark age, what precautions do we need to take today?

Facebook to integrate WhatsApp, Instagram and Messenger

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Facebook plans to integrate its messaging services on Instagram, WhatsApp and Facebook Messenger.

While all three will remain stand-alone apps, at a much deeper level they will be linked so messages can travel between the different services.

Facebook told the BBC it was at the start of a “long process”.

The plan was first reported in the New York Times and is believed to be a personal project of Facebook founder Mark Zuckerberg.

Once complete, the merger would mean that a Facebook user could communicate directly with someone who only has a WhatsApp account. This is currently impossible as the applications have no common core.

The work to merge the three elements has already begun, reported the NYT, and is expected to be completed by the end of 2019 or early next year.

Facebook-looking-dodgy in the news again this week (previously) with the news that they plan to integrate Instagram and WhatsApp into their central platform. They’re selling the upsides of this, such as that Facebook and WhatsApp users will be able to communicate with one another without switching to a different tool, but privacy advocates are understandably concerned: compared to Facebook, WhatsApp provides a reasonable level of anonymity. It also seems likely that this move may be an effort to preempt antitrust suits forcing Facebook’s property portfolio to be kept separate.

But even without those concerns, there are smaller but just-as-real, more-insidious privacy risks from this integration. With a very minor change to their terms and conditions about the use of the WhatsApp app Facebook can start performing even more-sophisticated big-data mining on the types of interpersonal relationships that they’re known to enjoy (let’s not forget that this is the company whose app will, left-unchecked, mine your mobile phone book to find friends-in-common that you have with other people, even if that friend-in-common doesn’t use Facebook!). With WhatsApp’s treasure trove of metadata, Facebook can determine who you talk to and, from where, and with what frequency: by technical necessity, none of this metadata is protected by WhatsApp’s end-to-end encryption. Similarly, they can determine what “groups” you participate in. This easily supports the “shadow profiles” they maintain which tell them far more about your life and interests than your mere Facebook profile alone does.

I for one will be watching WhatsApp with care and dropping it if it looks likely to “turn evil”. It’s not as though there aren’t (arguably better) alternatives, such as Signal (which I already use as my primary mobile text messaging system) and Riot.

Facebook may have known it was defrauding children and families through its online games

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Internal documents appear to show that Facebook knew it was defrauding children and families through its ecosystem of online games as early as 2011. Employees even had a name for the practice, which they dubbed “friendly fraud,” or FF for short. More damning, related documents show that Facebook employees had found a way to stop the fraud from happening, but the social media giant prioritized revenue instead.

Unshocker as internal memo at Facebook shows that they not only knew that kids were taking advantage of their parents’ credit card details being retained by Facebook-hosted freemium games to allow them to continue to make purchases, but that they specifically instructed their developers to make it as easy as possible for people to fall into this trap. Common industry practices like requiring selected card digits for additional purchases were not implemented specifically to help ensure that kids could more-easily go wild with their parents’ bank accounts.

Dropgangs, or the future of darknet markets

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

The Internet is full of commercial activity and it should come at no surprise that even illegal commercial activity is widespread as well. In this article we would like to describe the current developments – from where we came, where we are now, and where it might be going – when it comes to technologies used for digital black market activity.

The other major change is the use of “dead drops” instead of the postal system which has proven vulnerable to tracking and interception. Now, goods are hidden in publicly accessible places like parks and the location is given to the customer on purchase. The customer then goes to the location and picks up the goods. This means that delivery becomes asynchronous for the merchant, he can hide a lot of product in different locations for future, not yet known, purchases. For the client the time to delivery is significantly shorter than waiting for a letter or parcel shipped by traditional means – he has the product in his hands in a matter of hours instead of days. Furthermore this method does not require for the customer to give any personally identifiable information to the merchant, which in turn doesn’t have to safeguard it anymore. Less data means less risk for everyone.

The use of dead drops also significantly reduces the risk of the merchant to be discovered by tracking within the postal system. He does not have to visit any easily to surveil post office or letter box, instead the whole public space becomes his hiding territory.

From when I first learned about the existence of The Silk Road and its successors – places on the dark web where it’s possible to pseudo-anonymously make illicit purchases of e.g. drugs, weapons, fake ID and the like in exchange for cryptocurrencies like Bitcoin – it always seemed to me that the weak point was that the “buyer” had to provide their postal address to the “seller”. While there have, as this article describes, been a number of arrested made following postal inspections (especially as packages cross administrative boundaries), the bigger risk I’d assume that this poses to the buyer is that they must trust the seller (who is, naturally, a bigger and more-interesting target) to appropriately secure and securely-destroy that address information. In the event of a raid on a seller – or, indeed, law enforcement posing as a seller in a sting operation – the buyer is at significant risk.

That risk may not be huge for Johnny Pothead who wants to buy an ounce of weed, but it rapidly scales up for “middleman” distributors who buy drugs in bulk, repackage, and resell either on darknet markets or via conventional channels: these are obvious targets for law enforcement because their arrest disrupts the distribution chain and convictions are usually relatively easy (“intent to supply” can be demonstrated in many jurisdictions by the volume of the product in which they’re found to be in possession). A solution to this problem, for drug markets at least, with the fringe benefit of potentially faster-deliveries is pre-established dead drops (the downside, of course, is a more-limited geographical coverage and the risk of discovery by a non-purchaser, but the latter of these can at least be mitigated), and it’s unsurprising to hear that this is the direction in which the ecosystem is moving. And once you, Jenny Drugdealer, are putting that kind of infrastructure in place anyway, you might as well extend it to your regular clients too. So yeah: not surprising to see things moving in this direction.

I recall that some years ago, a friend whom I’m introduced to geocaching accidentally ran across a dead drop (or a stash) while hunting for a ‘cache that was hidden in the same general area. The stash was of clearly-stolen credit cards, and of course she turned it in to the police, but I think it’s interesting that these imaginative digital-era drug dealers, in trying to improve upon a technique popularised by Cold War era spies by adding the capacity for long-time concealment of dead drops, are effectively re-inventing what the geocaching community has been doing for ages.

What will they think of next? I’m betting drones.

Vasectomy

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Oh Joy Sex Toy - Vasectomy

This comic from the fabulous Oh Joy Sex Toy folks gives a pretty good explanation of vasectomy that mirrors my experience (part one, part two)… except for the fact that I didn’t have this dude’s anxiety issue and was instead (according to the surgeon) “creepily interested” in the nitty-gritty of what he was up to!

RFC-20

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

The choice of this encoding has made ASCII-compatible standards the language that computers use to communicate to this day.

Even casual internet users have probably encountered a URL with “%20” in it where there logically ought to be a space character. If we look at this RFC we see this:

   Column/Row  Symbol      Name

   2/0         SP          Space (Normally Non-Printing)

Hey would you look at that! Column 2, row 0 (2,0; 20!) is what stands for “space”. When you see that “%20”, it’s because of this RFC, which exists because of some bureaucratic decisions made in the 1950s and 1960s.

Darius Kazemi is reading a single RFC every day throughout 2019 and writing up his understanding as to the content and importance of each. It’s good reading if you’re “into” RFCs and it’s probably pretty interesting if you’re just a casual Internet historian.

Evaluating the GCHQ Exceptional Access Proposal

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

In a blog post, cryptographer Matthew Green summarized the technical problems with this GCHQ proposal. Basically, making this backdoor work requires not only changing the cloud computers that oversee communications, but it also means changing the client program on everyone’s phone and computer. And that change makes all of those systems less secure. Levy and Robinson make a big deal of the fact that their backdoor would only be targeted against specific individuals and their communications, but it’s still a general backdoor that could be used against anybody.

The basic problem is that a backdoor is a technical capability — a vulnerability — that is available to anyone who knows about it and has access to it. Surrounding that vulnerability is a procedural system that tries to limit access to that capability. Computers, especially internet-connected computers, are inherently hackable, limiting the effectiveness of any procedures. The best defense is to not have the vulnerability at all.

Lest we ever forget why security backdoors, however weasely well-worded, are a terrible idea, we’ve got Schneier calling them out. Spooks in democratic nations the world over keep coming up with “innovative” suggestions like this one from GCHQ but they keep solving the same problem, the technical problem of key distribution or key weakening or whatever it is that they want to achieve this week, without solving the actual underlying problem which is that any weakness introduced to a secure system, even a weakness that was created outwardly for the benefit of the “good guys”, can and eventually will be used by the “bad guys” too.

Furthermore: any known weakness introduced into a system for the purpose of helping the “good guys” will result in the distrust of that system by the people they’re trying to catch. It’s pretty trivial for criminals, foreign agents and terrorists to switch from networks that their enemies have rooted to networks that they (presumably) haven’t, which tends to mean a drift towards open-source security systems. Ultimately, any backdoor that gets used in a country with transparent judicial processes becomes effectively public knowledge, and ceases to be useful for the “good guys” any more. Only the non-criminals suffer, in the long run.

Sigh.

The Route of a Text Message

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

With each tap, a small electrical current passes from the screen to her hand. Because electricity flows easily through human bodies, sensors on the phone register a change in voltage wherever her thumb presses against the screen. But the world is messy, and the phone senses random fluctuations in voltage across the rest of the screen, too, so an algorithm determines the biggest, thumbiest-looking voltage fluctuations and assumes that’s where she intended to press.

Figure 0. Capacitive touch.

So she starts tap-tap-tapping on the keyboard, one letter at a time.

I-spacebar-l-o-v-e-spacebar-y-o-u.

I’ve long been a fan of “full story” examinations of how technology works. This one looks and the sending and receipt of an SMS text message from concept through touchscreen, encoding and transmission, decoding and display. It’s good to be reminded that whatever technology you build, even a “basic” Arduino project, a “simple” website or a “throwaway” mobile app, you’re standing on the shoulders of giants. Your work sits atop decades or more of infrastructure, standards, electronics and research.

Sometimes it feels pretty fragile. But mostly it feels like magic.

Security Checklist

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Be safe on the internet.

An open source checklist of resources designed to improve your online privacy and security. Check things off to keep track as you go.

I’m pretty impressed with this resource. It’s a little US-centric and I would have put the suggestions into a different order, but many of the ideas on it are very good and are presented in a way that makes them accessible to a wide audience.

The most unexpected answer to a counting puzzle

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Summary: if an idealised weight slides into another, bouncing it off a wall then back into itself, how many times will the two collide? If the two weights are the same then the answer is 3: the first collision imparts all of the force of the first into the second, the second collision is the second bouncing off the wall, and the third imparts the force from the second back into the first. If the second weight weighs ten times as much as the first, the answer turns out to be 31. One hundred times as much, and there are 314 bounces. One thousand times, and there are 3,141. Ten thousand times, and there are 31,415… spot the pattern? The number of bounces are the digits of pi.

Why? This is mindblowing. And this video doesn’t answer the question (completely): it only poses it. But I’ll be looking forward to the next episode’s explanation…

The Mystery

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Brian and Nick are back for the first time in, like, forever. Do you remember what happened before this? It was The Faux Pas, two years ago. And before that? And before that? And before that? The short of it is that it’s been a long time since your mom’s butthole was just fine.

There’s lots of ugliness in the world right now, so I think it’s important to share these photos…

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

There’s lots of ugliness in the world right now, so I think it’s important to share these photos of what happened when my friend Marvin called me & said: “I’m getting married & we can only invite 100 people. You didn’t make the cut. But you can come if you come as a drunk clown.”
(1) There’s not a lot of story to tell, but for anyone who wants some DRUNK CLOWN AT THE WEDDING backstory:

Marvin had a vision of a drunk clown crashing his wedding. It’s all he ever wanted. Laura was on board. That’s the kind of perfect-for-each-other weirdos they are.

(2) I arrived in a regular suit. I had the clown outfit, face paint, shavingg stuff (I had a full beard & needed to shave for the make-up) and two 40oz’s (Marvin asked for a drunk clown, so I was giving him a D*R*U*N*K clown) in a bag I hid in a bathroom next to the ceremony.
(3) I only knew a handful of people at the wedding. Didn’t know Marvin or Laura’s families. More importantly, they didn’t know me. Which made me the perfect surprise drunk clown.
(4) I didn’t want them to recognize me when I showed up as a clown — the idea was to make it feel like an actual drunk clown had crashed the festivities — so I didn’t mingle much.
(5) As soon as the ceremony was over, people were directed to another area for a wine reception. I slipped away to the bathroom with @AimieRocks, who was helping with my make-up. I shaved off the beard, did my face, got into the clown suit, and pounded one of the 40oz’s.
Total lightweight here. I was hammered pretty quickly. I’m a method actor, so I drank half the other 40oz too. Then I stumbled over to the wine reception.
(7) I barged in, marched over to Laura’s mom, grabbed her wine, downed it, then handed the empty glass back to her. CONFUSION. MILD CHAOS.

WHO IS THIS DRUNK CLOWN?

(8) I accidentally shattered a few wine glasses, but I gotta say I brought a real JOVIAL DRUNK CLOWN vibe to the whole affair, so people embraced me pretty quickly, even though I kept drinking their wine.
(9) Except for Laura’s dad, who called for security to escort me out. She had to tell him that I was AN OFFICIAL MEMBER OF THE WEDDING PARTY.

Best Man ☑️
Maid of Honor ☑️
Drunk Clown ☑️

(10) At some point, we must have gone into the vineyard to take those photos in the original tweet up above, but honestly I was so drunk that I don’t remember taking them.

Anyway, I told you there wasn’t much backstory. It was an awesome wedding. <end>

ADDENDUM: just found this photo & it made me laugh. This is after security was called off, after everyone found out I wasn’t a DRUNK CLOWN STRANGER but a DRUNK CLOWN FRIEND. And everyone’s just…so…completely…CHILL. Just like, “whatevs,” as I drink more.
(12) OMG okay so I guess I have to make a SECOND ADDENDUM because @AimieRocks just emailed me some more photos from the wedding. Adding them to this thread…
(13) What I wore to the wedding ceremony. (That’s not my hat, that’s @AimieRocks‘s hat, I’m *not* a hat person but wearing it made me feel like Diane Keaton.) Posting these photos so you can see the beard I had before my clown transformation. I shaved that thing off SO QUICKLY.
(14) DRUNK WEDDING CLOWN, A PORTRAIT. I hate beer so much, but I had to get in character and I feel like drunk wedding clowns drink beer??? I’ve barely had any of the beer and already a little drunk in this photo. We didn’t leave the bathroom until after I finished that bottle.
(15) Last three photos. I love how Laura’s pretending not to know me in that first one. The kissing photo is with another good college friend, Michal. I have no idea who I’m talking to in that third photo. <end addendum> xx
Marvin just joined twitter to tell me that’s his mom I’m hugging in the third photo in this tweet. I’M SORRY, MARVIN. But welcome to twitter. xo
(17) ADDENDUM #3: @MarvinSolomon8 just texted me the name of their wedding photographer. Shoutout to SAMUEL POTTER PHOTOGRAPHY in Paso Robles. Here’s his website:

He took the three vineyard photos & obviously has a great eye. THANK YOU SAMUEL POTTER.

I was at a party this afternoon and an old friend introduced me to his wife, then told her: “honey, this is the drunk clown I told you about.”
Someone messaged me asking if they could interview me about the drunk clown stuff for a TV show & we’re about to skype. I texted my mom and asked “how do I look?” This is her reply. WHAT DOES THIS EVEN MEAN??? IS THAT A GOOD THING OR A BAD THING??? WHAT ARE YOU TELLING ME, MOM???
My grandma’s been in the hospital with bad shingles & infection. It’s been a scary, stressful week, & she’s been in bad pain. But she’s getting A LOT better. And thankfully she just got moved to rehab facility.

My mom just texted me this photo she took of grandma’s new room.

A friend just texted that he’s showing these drunk wedding clown photos to his family tomorrow and I hope it brings them all closer together.
× × × × × ×